On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said…
Invisible but present, and far from the eyes of the public
This article is about how I found a vulnerability on Apple forgot password endpoint that allowed me to takeover an iCloud account. The vulnerability is completely patched by Apple security team and it no longer works. Apple Security Team rewarded me $18,000 USD as a part of their bounty program but I refused to…
Zero-Click Zip TL;DR
As previously announced, starting on August 13, 2021, at 09:00 PST, we will no longer accept account passwords when authenticating Git operations on GitHub.com. Instead, token-based authentication (for example, personal…
Stories about computer security tend to go viral when they bridge the vast divide between geeks and luddites, and this week’s news about a hacker who tried to poison a Florida town’s water supply was understandably front-page material. But for security nerds who’ve been warning about this sort of thing for ages, the…
Teardown and analysis of electronics. Integrated circuit design analysis.
Federal law enforcement has been asking for a backdoor to read Americans’ encrypted communications for years now. FBI Director Christopher Wray did it again last week in testimony to the Senate Judiciary Committee. As usual, the FBI’s complaints involved end-to-end encryption employed by popular...
In the beginning of Terminator 2: Judgement Day, John Connor uses a laptop to crack the PIN of a stolen debit card.
Overview On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting
The Belgian government has removed 'backdoor requirement' from new law after international protest.
The Logging Services Security Team takes security seriously. This allows our users to place their trust in Log4j for protecting their mission-critical data. On this page, we will help you find guidance on security-related issues and access to known vulnerabilities.
The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing…
There is a lot more on the internet than just social media and banking websites…
In October, the popular and famous archivist tool youtube-dl was taken down by GitHub due to a DMCA request by the Recording Industry Association of America. I posted a detailed analysis explaining the relation between international, US, EU and German law, and showing why this request was very different from what most…
The forthcoming Senate draft of Biden's infrastructure bill—a 2,000+ page bill designed to update the United States’ roads, highways, and digital infrastructure—contains a poorly crafted provision that could create new surveillance requirements for many within the blockchain ecosystem. This could...
Every donation between now and December 31 will be matched, 1:1, by Friends of Tor. Stand up for the human right to privacy and donate to the Tor Project today. Plus… new swag!
Posted by Natalie Silvanovich, Project ZeroOn January 29, 2019, a serious vulnerability was ...
"Whatever you do will be insignificant, but it is very important that you do it." -Mahatma Gandhi
Using Tor to aid various system administration tasks, including checking firewall rules, bypassing internal network restrictions and connecting to remote systems that are behind NAT/CGNAT.
Thanks to Nagli and d0xing for helping figure out what was happening with this issue.
According to Wired, Signal is adding support for the cryptocurrency MobileCoin, “a form of digital cash designed to work efficiently on mobile devices while protecting users’ privacy and even their anonymity.” Moxie Marlinspike, the creator of Signal and CEO of the nonprofit that runs it, describes the new payments…
A detailed description of how we made Google Docs run inside the new Flow Browser. The number of websites that work in Flow is increasing regularly.
Detectify analyzed 50,000 unique Nginx configuration files on GitHub and reported some common misconfigurations.
Today, Mozilla published an independent security audit of its Mozilla VPN, which provides encryption and device-level protection of your connection and inf
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
Nearly every modern smartphone is equipped with an accelerometer, which, as the name implies, is a sensor that measures acceleration. It’s most commonly used for detecting the device’s orientation. It also has many other uses, whether as a game controller in racing games, as a pedometer for counting daily steps, or to…
